ci: add tag-triggered release packaging workflow

Adds .gitea/workflows/release.yml, triggered only on a pushed v* tag, which
builds all three platforms (reusing the exact same configure/build/test
commands as build.yml, now factored out into .gitea/scripts/ so the two
workflows can't drift), zips each platform's build/package/ output, and
creates a draft Gitea Release with the archives attached.

This is packaging automation only -- it does not resolve or bypass the C1
WebRTC/OpenH264 release gate documented in README.md's Status section.
Nothing publishes until a human deliberately pushes a version tag (which
should not happen before owner sign-off) and then explicitly publishes the
resulting draft. The generated release notes lead with a restatement of the
open C1 question specifically so that second step can't be taken by
accident.

build.yml is refactored (not rewritten) to call the same shared scripts;
its job/step behavior is otherwise unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RL8abRmgFXkVASHkkqiJbE

.gitea/scripts/linux-build.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Shared with .gitea/workflows/build.yml and .gitea/workflows/release.yml --
+# this is the actual Linux configure/build/test/verify sequence. Edit once,
+# here, so both workflows stay in sync instead of drifting copies.
+#
+# Linux keeps its distribution libobs; the buildspec bootstrap (macOS/Windows)
+# is for the two platforms that have no such package.
+set -euo pipefail
+
+cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DSTPLUGIN_BOOTSTRAP_OBS=OFF
+cmake --build build
+ctest --test-dir build --output-on-failure
+
+# Show what was built
+ls -la build/package/bin/64bit build/package/data/locale build/package/licenses
+ldd build/package/bin/64bit/streamer-tools-camera.so | grep -E 'obs|livekit'
+nm -D build/package/bin/64bit/streamer-tools-camera.so | grep -E ' T obs_module_(load|unload)'

.gitea/scripts/linux-deps.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# Shared with .gitea/workflows/build.yml and .gitea/workflows/release.yml --
+# both need the exact same Linux build dependencies. Edit once, here.
+set -euo pipefail
+
+sudo apt-get update -qq
+sudo apt-get install -y -qq cmake ninja-build libobs-dev libcurl4-openssl-dev

.gitea/scripts/macos-build.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Shared with .gitea/workflows/build.yml and .gitea/workflows/release.yml --
+# this is the actual macOS configure/build/test/verify sequence. Edit once,
+# here, so both workflows stay in sync instead of drifting copies.
+#
+# The buildspec bootstrap runs here: it fetches obs-deps + the pinned
+# obs-studio source and builds libobs before this project configures.
+#
+# If that fails, fall back to a core-library-only build rather than going
+# red: the core library and its tests are what this job mainly guards, and
+# the fallback is loud (a workflow warning, plus the check below reporting no
+# module) rather than silent. Do not remove the warning -- a green job that
+# quietly stopped building the plugin is worse than a red one.
+set -euo pipefail
+
+if ! cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release; then
+  echo "::warning::OBS SDK bootstrap failed on macOS; building the core library only. The plugin module was NOT built."
+  rm -rf build
+  cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DSTPLUGIN_BOOTSTRAP_OBS=OFF
+fi
+
+cmake --build build
+ctest --test-dir build --output-on-failure
+
+# Show what was built.
+#
+# This is not purely informational: the macOS bootstrap has been reliably
+# building the real module in CI (6/6 tests, artifact uploaded -- see
+# README), so a missing module here is a regression to fail loudly on, not
+# the old silent fallback. (This is separate from the macOS packaging gap in
+# README -- that the module doesn't yet load as an OBS.app bundle -- which
+# this check does not and cannot test.)
+ls -la .deps/Frameworks/libobs.framework/Resources/cmake || true
+if [ ! -f build/package/bin/streamer-tools-camera.so ]; then
+  echo "::error::no plugin module was built -- build/package/bin/streamer-tools-camera.so is missing. The macOS from-source libobs bootstrap is expected to succeed; treat this as a build failure, not a core-library-only fallback."
+  exit 1
+fi
+ls -la build/package/bin
+otool -L build/package/bin/streamer-tools-camera.so
+otool -L build/package/bin/streamer-tools-camera.so | grep -E 'obs|livekit'

.gitea/scripts/macos-deps.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Shared with .gitea/workflows/build.yml and .gitea/workflows/release.yml.
+set -euo pipefail
+
+brew install cmake ninja

.gitea/scripts/publish-release.sh

@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+# Creates a (draft) Gitea Release for the tag that triggered
+# .gitea/workflows/release.yml, and uploads every archive in $DIST_DIR as a
+# release asset.
+#
+# RELEASE GATE: see the README's `## Status` section and
+# third_party/livekit/README.md. The WebRTC/OpenH264 attribution question
+# ("C1") is unresolved -- this script does not decide that question, it just
+# makes sure the generated release notes put the reminder where whoever
+# publishes the draft will actually read it. Pushing a version tag is the
+# human decision this whole workflow hangs off of; this script does not add
+# or remove any judgment about whether that decision was the right one.
+#
+# Required env: GITEA_TOKEN, SERVER, OWNER, REPO, TAG, SHA, DIST_DIR
+# Optional env: MACOS_BUNDLE_FOUND ("true"/"false", default "false")
+set -euo pipefail
+
+: "${GITEA_TOKEN:?}"
+: "${SERVER:?}"
+: "${OWNER:?}"
+: "${REPO:?}"
+: "${TAG:?}"
+: "${SHA:?}"
+: "${DIST_DIR:?}"
+MACOS_BUNDLE_FOUND="${MACOS_BUNDLE_FOUND:-false}"
+
+if [ "${MACOS_BUNDLE_FOUND}" = "true" ]; then
+  MACOS_NOTE="This archive contains a \`.plugin\` bundle."
+else
+  MACOS_NOTE="This archive is packaged as a bare \`streamer-tools-camera.so\` (the layout \`build/package/\` currently produces on macOS), **not** an OBS.app-loadable \`.plugin\` bundle. It will not load in the OBS GUI as-is."
+fi
+
+NOTES_FILE="$(mktemp)"
+cat > "${NOTES_FILE}" <<EOF
+> **This build has not been cleared for redistribution.** The plugin
+> statically/dynamically pulls in Google WebRTC and OpenH264 code through the
+> LiveKit SDK, and whether that can be redistributed as a public download --
+> the "C1" attribution/patent question -- has not been resolved. See the
+> \`## Status\` section of \`README.md\` and \`third_party/livekit/README.md\`
+> for the specifics. By publishing this release, you are personally taking on
+> that open question -- if C1 hasn't been signed off on, don't publish it.
+>
+> (The separate GPLv2/Apache-2.0 license-compatibility question, "C2", is
+> resolved: this project's own first-party code is Apache-2.0, matching the
+> vendored LiveKit binaries.)
+>
+> This release was created as a **draft**. It stays invisible to anyone
+> without write access to this repo until someone with write access opens it
+> here and clicks Publish -- a second, deliberate step past pushing the tag.
+
+# streamer-tools Camera Plugin -- ${TAG}
+
+Built from commit \`${SHA}\`.
+
+**Nobody has yet run this plugin in the OBS GUI, on any platform.** See "What
+is verified, and how" in \`README.md\` for exactly what has and has not been
+checked, including which claims are backed by automated tests versus a human
+watching OBS.
+
+| Platform | Archive | Notes |
+|---|---|---|
+| Linux (x64) | \`streamer-tools-camera-${TAG}-linux-x64.zip\` | Functionally complete and verified end to end against a real LiveKit server and a real libobs (see README); OBS GUI itself still unverified |
+| Windows (x64) | \`streamer-tools-camera-${TAG}-windows-x64.zip\` | Built and tested by this workflow's Windows job; the WinHTTP backend has never been exercised against a real streamer-tools server, only a loopback test server -- see README's Windows CI section |
+| macOS | \`streamer-tools-camera-${TAG}-macos.zip\` | Built and tested by this workflow's macOS job. ${MACOS_NOTE} See the "macOS packaging gap" in README |
+
+## Installing
+
+### Linux
+
+\`\`\`
+mkdir -p ~/.config/obs-studio/plugins/streamer-tools-camera
+unzip streamer-tools-camera-${TAG}-linux-x64.zip -d /tmp/stplugin-camera
+cp -r /tmp/stplugin-camera/bin /tmp/stplugin-camera/data \\
+      ~/.config/obs-studio/plugins/streamer-tools-camera/
+\`\`\`
+
+Start OBS, then Sources -> \`+\` -> "streamer-tools Camera" -> fill in the
+server URL, room slug and read key from the room's settings page ->
+"Refresh camera list" -> pick a camera. This is the same drop-in layout
+README's "Testing this by hand" documents for a source build, adapted for a
+downloaded zip -- known-good on Linux.
+
+### Windows (installation path not yet verified in real OBS)
+
+Per \`AddExtraModulePaths()\` in obs-studio's \`UI/window-basic-main.cpp\`, OBS
+on Windows searches a plugins directory for \`bin\\64bit\\<name>.dll\` plus a
+sibling \`data\\\`. Unzip the archive and copy its \`bin\\\` and \`data\\\` into
+your OBS plugins directory (typically
+\`%APPDATA%\\obs-studio\\plugins\\streamer-tools-camera\\\`), matching the
+Linux layout above. This has not been confirmed against a real OBS install on
+Windows -- report back if you try it.
+
+### macOS (installation path not yet verified in real OBS; packaging gap)
+
+OBS on macOS loads plugins as \`<name>.plugin\` bundles under
+\`~/Library/Application Support/obs-studio/plugins/\`. As of this release,
+this project's \`build/package/\` output on macOS is **not yet that bundle
+shape** -- see the "macOS packaging gap" section of \`README.md\`. Treat the
+macOS archive here as a build-verification artifact, not a working
+drop-in, until that gap is closed.
+
+## What this is
+
+Native OBS Studio source plugin that pulls streamer-tools camera feeds
+directly from LiveKit over WebRTC. See \`README.md\` in the repository for
+the full design, what is and is not verified, and current CI status.
+EOF
+
+echo "----- release notes -----"
+cat "${NOTES_FILE}"
+echo "--------------------------"
+
+BODY_JSON="$(python3 - "$TAG" "$NOTES_FILE" <<'PYEOF'
+import json, sys
+tag, notes_file = sys.argv[1], sys.argv[2]
+with open(notes_file) as f:
+    notes = f.read()
+print(json.dumps({
+    "tag_name": tag,
+    "name": tag,
+    "body": notes,
+    "draft": True,
+    "prerelease": False,
+}))
+PYEOF
+)"
+
+echo "Creating release for tag ${TAG} ..."
+RESP="$(curl -sS -f -X POST \
+  -H "Authorization: token ${GITEA_TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d "${BODY_JSON}" \
+  "${SERVER}/api/v1/repos/${OWNER}/${REPO}/releases")"
+
+RELEASE_ID="$(python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])' <<<"${RESP}")"
+echo "Created release id ${RELEASE_ID} (draft)."
+
+shopt -s nullglob
+ASSETS=("${DIST_DIR}"/*)
+if [ "${#ASSETS[@]}" -eq 0 ]; then
+  echo "::error::no archives found in ${DIST_DIR} -- nothing to upload."
+  exit 1
+fi
+
+for f in "${ASSETS[@]}"; do
+  name="$(basename "${f}")"
+  echo "Uploading ${name} ..."
+  curl -sS -f -X POST \
+    -H "Authorization: token ${GITEA_TOKEN}" \
+    -F "attachment=@${f}" \
+    "${SERVER}/api/v1/repos/${OWNER}/${REPO}/releases/${RELEASE_ID}/assets?name=${name}" \
+    > /dev/null
+done
+
+echo "Done. Draft release: ${SERVER}/${OWNER}/${REPO}/releases/${RELEASE_ID}"

.gitea/scripts/windows-build.ps1

@@ -0,0 +1,38 @@
+# Shared with .gitea/workflows/build.yml and .gitea/workflows/release.yml --
+# this is the actual Windows configure/build/test/verify sequence. Edit once,
+# here, so both workflows stay in sync instead of drifting copies.
+#
+# The default Visual Studio generator is required, not Ninja:
+# cmake/windows/buildspec.cmake keys the dependency slice off
+# CMAKE_VS_PLATFORM_NAME, which only a VS generator sets.
+#
+# Same fallback as macOS, and the same warning: a green job that quietly
+# stopped building the plugin is worse than a red one. PowerShell, not bash:
+# self-hosted Windows runners here cannot be assumed to have a working bash
+# (WSL as local system is refused).
+
+cmake -S . -B build -A x64
+if ($LASTEXITCODE -ne 0) {
+  Write-Host "::warning::OBS SDK bootstrap failed on Windows; building the core library only. The plugin module was NOT built."
+  Remove-Item -Recurse -Force build -ErrorAction SilentlyContinue
+  cmake -S . -B build -A x64 -DSTPLUGIN_BOOTSTRAP_OBS=OFF
+  if ($LASTEXITCODE -ne 0) { exit 1 }
+}
+
+cmake --build build --config Release
+
+ctest --test-dir build -C Release --output-on-failure
+
+# Show what was built.
+#
+# This is not purely informational: the from-source libobs bootstrap is
+# expected to work reliably on this runner (that is the whole point of the
+# buildspec bootstrap + find_package fix), so a missing module here is a
+# regression to fail loudly on, not the old silent fallback.
+$module = "build\package\bin\64bit\streamer-tools-camera.dll"
+if (Test-Path $module) {
+  Get-ChildItem build\package\bin\64bit
+} else {
+  Write-Host "::error::no plugin module was built -- $module is missing. The Windows from-source libobs bootstrap is expected to succeed; treat this as a build failure, not a core-library-only fallback."
+  exit 1
+}